What is Shield Platform Encryption and how does it differ from Classic Encryption?

Shield Platform Encryption encrypts data at rest using AES-256 encryption, protecting data even from Salesforce employees with infrastructure access. It uses a tenant secret combined with a master secret (held by Salesforce) to derive an org-specific data encryption key. BYOK (Bring Your Own Key) allows the customer to supply the tenant secret, giving them key control. Limitations: encrypted fields cannot be used in certain filter conditions, SOQL WHERE clauses, duplicate rules, or formula fields. Classic Encryption is an older feature that only masks field values on screen — it does not encrypt data at the database level and has far weaker security guarantees. Shield also supports Cache-Only Keys for highest security (keys never persist in Salesforce infrastructure).